[GH-1977] Added zizmor with pre-commit

[Aashish-Jha-11]

Did you read the Contributor Guide?

• Yes, I have read the Contributor Rules and Contributor Development Guide

Is this PR related to a ticket?

• Yes, Add zizmor with pre-commit #1977

What changes were proposed in this PR?

• Added zizmor with pre-commit

Did this PR include necessary documentation updates?

• No, this PR does not affect any public API so no need to change the documentation.

[jiayuasu]

@Aashish-Jha-11 please fix the lint issue

[Aashish-Jha-11]

Thank you for the review and feedback!
Apologies for the lint issues — this was my first time contributing to such a large open-source project, and I'm still learning the workflows. I’ve fixed the issues now. Really grateful for the opportunity to contribute and improve.

[Aashish-Jha-11]

I've enhanced our CI/CD security by adding the zizmor static analysis tool to our pre-commit configuration. This addition helps protect our GitHub Actions workflows from common security vulnerabilities.

Changes made:
Added zizmor pre-commit hook with these settings:

Repository: https://github.com/zizmorcore/zizmor-pre-commit
Version: v1.9.0
Hook ID: zizmor
Configured to scan all GitHub Actions workflow files
Fixed security issues in existing workflows:

Updated r.yml workflow to use commit SHA pinning instead of version tags
Replaced r-lib/actions/@v2.11.3 references with r-lib/actions/@bd49c52ffe281809afa6f0fecbf37483c5dd0b93
Benefits:
The zizmor pre-commit hook will automatically scan all workflows for security issues, including:

Unpinned action references (which could be hijacked)
Overly broad permissions
Credential persistence issues
Other GitHub Actions security best practices
This should help maintain a more secure CI/CD pipeline for all contributors. When creating or updating workflows, the pre-commit hook will identify security issues before they reach our repository.

[jiayuasu]

Is this because this commit belongs to an unreleased version?

[Aashish-Jha-11]

Thanks for pointing that out,
Yes, this is because GitHub Actions security best practices recommend pinning to a full commit SHA instead of using version tags, which are mutable.

I verified that bd49c52... is the current commit behind v2.11.3 at the time of change, so this ensures reproducibility and avoids any tampering even if the tag is moved in the future.

Let me know if you'd prefer using a different version or want it changed back to tag-based reference. 😊

[jiayuasu]

thanks for the detailed explanation. I actually prefer the tag-based reference. Would you please change it back?

[Aashish-Jha-11]

Sure! I’ll switch it back to the tag-based reference as suggested. Thanks again for the clarification and feedback — learning a lot through this process! 😊

[Aashish-Jha-11]

Hi @jiayuasu Sir,
I'm currently facing some lint issues related to GitHub Actions. One of the errors is error[unpinned-uses], which occurs when actions are referenced using tags like @v2.11.3. To fix this, I tried using the full commit SHA instead, since the linter requires pinning to a specific version hash for security.

Would you mind helping me with the correct way to handle this? I just want to make sure I'm following the project's guidelines properly.

Thank you!

[jbampton]

Hi @jiayuasu Sir, I'm currently facing some lint issues related to GitHub Actions. One of the errors is error[unpinned-uses], which occurs when actions are referenced using tags like @v2.11.3. To fix this, I tried using the full commit SHA instead, since the linter requires pinning to a specific version hash for security.

Would you mind helping me with the correct way to handle this? I just want to make sure I'm following the project's guidelines properly.

Thank you!

Hello @Aashish-Jha-11 you can use a config file to ignore some audit rules

https://docs.zizmor.sh/configuration/

Read up on the rules here:

https://docs.zizmor.sh/audits/

[jbampton]

Hey @Aashish-Jha-11 you should read about pre-commit in the Sedona docs. pre-commit is running on the CI with GitHub Actions but pre-commit is really a git hooks framework which can also run on your local machine before pushing up to GitHub. So you can test on your local machine with the audit rules and config file

https://sedona.apache.org/latest-snapshot/setup/compile/#pre-commit

If you are not really sure how to finish this PR I can try to finish it. Since you have already done some work we can always use another PR that I create and we can put you down as the commit co-author so you get credit for the existing work.

https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors

[Aashish-Jha-11]

Hi @jbampton ,

Thank you so much for explaining and for sharing the helpful links. Since this is my first time contributing to a large open-source project like this, I’ve tried multiple approaches to fix the pre-commit and lint issues locally, but I’m still getting stuck.

If it’s okay, I would really appreciate it if you could help finish this PR and add me as a co-author for the contribution. Thanks again for your guidance and support!